CISA Alert: Watchfire Controller Software Hardcoded Key Allows RCE via Malicious Firmware

Vulnerability Overview Vulnerability Name: Watchfire Controller Software Release Date: July 30, 2026 Alert Code: ICSA-26-211-09 Related Topics: Industrial Control System Vulnerabilities, Industrial Control Systems CVSS Score: 3.5.7 Vendor: Watchfire Device: Watchfire Controller Software Vulnerability Description: Successful exploitation of this vulnerability may allow a malicious user to deliver malicious firmware, thereby updating and gaining complete control over the controller. Vulnerability Type: Use of Hardcoded Cryptographic Key Impact Scope Affected Versions: - BC550 12.30 (CVE-2026-5846) - BC750 11.33 - BC760 12.38 - BC760DC 12.39 (CVE-2026-5846) Critical Infrastructure Sectors: Commercial Facilities, Critical Manufacturing, Healthcare and Public Health, Financial Services Deployed Countries/Regions: United States, Dominican Republic, Canada, Peru, El Salvador Company Headquarters Location: United States Remediation Recommended Practices: - Minimize the network exposure of all control system devices and/or systems to ensure they are not accessible from the Internet. - Place control system networks and remote devices behind firewalls and isolate them from business networks. - When remote access is required, use more secure methods such as Virtual Private Networks (VPNs), and recognize that VPNs may have vulnerabilities and should be updated to the latest version. - Organizations should conduct appropriate impact analysis and risk assessment before deploying defensive measures. - Implement recommended cybersecurity policies to proactively defend ICS assets. - Follow internal procedures to report suspicious malicious activity and adhere to CISA's tracking and correlation procedures. - Do not click on links in unsolicited emails or open attachments. - Avoid social engineering attacks such as phishing. Additional Information Acknowledgment: James Tillson reported this vulnerability to CISA. Revision History: - Initial Release Date: July 30, 2026 - Revision 1: Initial Release Tags Sectors: Commercial Facilities Sector, Critical Manufacturing Sector, Financial Services Sector, Healthcare and Public Health Sector Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Related Links Related Alerts: - Schneider Electric IGSS - Johnson Controls OpenBlue Employee - MikroTik RouterOS - Toptech Systems RCU II+ and Multiload II+ Feedback Share Your Thoughts: We recently updated our anonymous product survey; feedback is welcome. Legal Notice and Terms of Use This product is subject to this notice and the privacy and usage policy. Contact Information CISA Central: 1-844-Say-CISA, contact@cisa.dhs.gov Official Website CISA.gov: Official website of the U.S. Department of Homeland Security Other Links About CISA: Budget and Performance, DHS.gov, FOIA Requests Department of Homeland Security (DHS): Office of Inspector General, Privacy Policy, Subscribe The White House: USA.gov, Website Feedback Social Media Facebook, Twitter, LinkedIn, YouTube, Flickr, RSS Back to Top Back to Top Link Footer CISA.gov: Official website of the U.S. Department of Homeland Security Additional Information About CISA: Budget and Performance, DHS.gov, FOIA Requests Department of Homeland Security (DHS): Office of Inspector General, Privacy Policy, Subscribe The White House: USA.gov, Website Feedback Social Media Facebook, Twitter, LinkedIn, YouTube, Flickr, RSS Back to Top Back to Top Link Footer CISA.gov: Official website of the U.S. Department of Homeland Security Other Links About CISA: Budget and Performance, DHS.gov, FOIA Requests Department of Homeland Security (DHS): Office of Inspector General, Privacy Policy, Subscribe The White House: USA.gov, Website Feedback Social Media Facebook, Twitter, LinkedIn, YouTube, Flickr, RSS Back to Top Back to Top Link Footer CISA.gov: Official website of the U.S. Department of Homeland Security Other Links About CISA: Budget and Performance, DHS.gov, FOIA Requests Department of Homeland Security (DHS): Office of Inspector General, Privacy Policy, Subscribe The White House: USA.gov, Website Feedback Social Media Facebook, Twitter, LinkedIn, YouTube, Flickr, RSS Back to Top Back to Top Link Footer CISA.gov: Official website of the U.S. Department of Homeland Security Other Links About CISA: Budget and Performance, DHS.gov, FOIA Requests Department of Homeland Security (DHS): Office of Inspector General, Privacy Policy, Subscribe The White House: USA.gov, Website Feedback Social Media Facebook, Twitter, LinkedIn, YouTube, Flickr, RSS Back to Top Back to Top Link Footer CISA.gov: Official website of the U.S. Department of Homeland Security Other Links About CISA: Budget and Performance, DHS.gov, FOIA Requests Department of Homeland Security (DHS): Office of Inspector General, Privacy Policy, Subscribe The White House: USA.gov, Website Feedback Social Media Facebook, Twitter, LinkedIn, YouTube, Flickr, RSS Back to Top Back to Top Link Footer CISA.gov: Official website of the U.S. Depa

Goal Reached Thanks to every supporter — we hit 100%!

CISA Alert: Watchfire Controller Software Hardcoded Key Allows RCE via Malicious Firmware